,i  #aag? ,,congress  #a/ ,session  ,h4 
,r4 #ahaf  ,,9 ,,! ,,h\se ,,(           
,,repres5tatives  ,m>* #aa1 #bjba,ms4   
,del,bene 7= h]self1 ,mr4 ,kilm]1 ,ms4  
,/rickl&1 ,ms4 ,h\lahan1 ,mr4 ,blum5au]1
 ,mr4 ,himes1 ,mr4 ,cri/1 ,mr4 ,l>son ( 
,connecticut1 ,ms4 ,wild1 ,mr4          
,p]lmutt]1 ,mr4 ,c>twright1 ,mr4        
,hors=d1 ,mr4 ,case1 ,mr4 ,ryan1 ,ms4   
,slotk91 ,ms4 ,s*ri]1 ,mr4 ,bey]1 ,mr4  
,l>s5 ( ,wa%+ton1 & ,mr4 ,co/a7         
introduc$ ! foll[+ bill2 :i* 0 ref]r$ to
 ! ,committee on ,en]gy & ,comm]ce  ,a  
,,bill  ,to require ! ,f$]al ,trade     
,commission to promulgate regulations   
relat$ to s5sitive p]sonal in=mation1 & 
= o!r purposes4  #a4 ,%ort title ,?is   
,act may be cit$ z ! ,in=mation         
,transp>5cy  ,p]sonal ,data ,control    
,act4  #b4 ,s5se ( ,congress ,x is !    
,s5se ( ,congress t-- 7#a7 ! ,unit$     
,/ates mu/ develop a balanc$1 high-/&>d 
digital privacy framework t complem5ts  
global /&>ds2  7#b7 a key elem5t ( ?is  
framework is a /rong national /&>d t    

combats anti-consum] practices2  7#c7 x 
is critical t ! ,f$]al ,gov]nm5t provide
 guidance on ! collection1 process+1    
disclosure1 transmission & /orage (     
s5sitive data2  7#d7 x is important to  
provide ! ,nation ) fair & ?\ghtful     
digital consum] rights ) respect to su* 
data2  7#e7 x is important to ensure t  
en=cem5t au?orities h ! res\rces ne$$ to
 protect consum]s f unlawful & deceptive
 acts ( practices 9 ! data privacy &    
security space2 &  7#f7 individuals h a 
"r to-- 7,a7 ex]cise control ov] !      
p]sonal data companies collect f !m & h[
 !y use x2  7,b7 easily und]/&able &    
accessible in=mation ab\t privacy &     
security practices2  7,c7 expect t      
companies w collect1 use1 & disclose    
p]sonal data 9 ways t are consi/5t ) !  
context 9 :i* consum]s provide ! data2  
7,d7 secure & responsible h&l+ (        
s5sitive p]sonal in=mation2  7,e7 access
 & correct p]sona data 9 usable =mats1 9
 a mann] t is appropriate to !          
s5sitivity ( ! data & ! risk ( adv]se   

consequ5ces to consum]s if ! data is    
inaccurate2 &  7,f7 reasonable limits on
 ! p]sonal data t companies collect &   
reta94  #c4 ,requirem5ts = s5sitive     
p]sonal in=mation  7a7 ,regulations ,n  
lat] ?an #ah mon?s aft] ! date (        
enactm5t ( ?is ,act1 ! ,f$]al ,trade    
,commission %all promulgate regulations 
"u section #eec ( title #e1 ,unit$      
,/ates ,code1 to require1 except z      
provid$ 9 subsection 7b71 controll]s1   
processors1 & ?ird p>ties to make       
available to ! public involv+ !         
collection1 transmission1 /orage1       
process+1 sale1 %>+ ( s5sitive p]sonal  
in=mation1 or o!r use ( s5sitive p]sonal
 in=mation f p]sons op]at+ 9 or p]sons  
locat$ 9 ! ,unit$ ,/ates :5 ! s5sitive  
p]sonal in=mation is collect$1          
transmitt$1 /or$1 process$1 sold or %>$ 
to meet ! foll[+ requirem5ts3 7#a7      
,affirmative1 express1 & opt-9 cons5t   
7,a7 ,any controll] %all provide us]s ^:
 p]sonal in=mation is collect$1         
transmitt$1 /or$1 process1 sold1 or     

o!rwise %>$ ) notice ?r\gh a privacy &  
data use policy ( a specific reque/ to  
collect1 transmit1 sell1 %>e or o!rwise 
disclose _! s5sitive p]sonal in=mation &
 require t us]s provide affirmative1    
express cons5t to any functionality t   
involves ! sale1 %>+1 or o!r disclosure 
( s5sitive p]sonal in=mation1 includ+   
%>+ s5sitive p]sonal in=mation ) ?ird   
p>ties1 if ! s5sitive p]sonal in=mation 
is to be us$ by ! ?ird p>ty = purposes  
o!r ?an ! purposes outl9$ 9 ! notice4   
7,b7 ,! docum5t$ in/ruction f a         
controll] to a processor or ?ird p>ty   
%all adh]e to ! limits ( ! cons5t grant$
 9 subp>agraph 7,a71 & processors & ?ird
 p>ties %all n use or disclose !        
s5sitive p]sonal in=mation = any o!r    
purposes or 9 any way t exce$s ! limits 
( ! cons5t grant$ 9 subp>agraph 7,a74   
7,c7 ,controll]s & processors %all n be 
liable = ! failure ( ano!r processor or 
?ird p>ty to adh]e to ! limits ( an     
opt-9 cons5t grant$ "u subp>agraph 7,a74
  7#b7 ,privacy & data use policy       

,controll]s1 processors1 & ?ird p>ties  
%all publicly ma9ta9 an up-to-date1     
transp>5t privacy1 security1 & data use 
policy t meets g5]al requirem5ts1       
includ+ t su* policy1 pres5t$ 9 !       
context :]e x applies-- 7,a7 is concise1
 intelligible1 & uses pla9 language2    
7,b7 is cle> & conspicu\s consi/5t ) !  
guidel9es ( ! ,f$]al ,trade ,commission2
  7,c7 uses visualizations1 :]e         
appropriate to make complex in=mation   
und]/&able by ! ord9>y us]2 &  7,d7 is  
provid$ free ( *>ge4  7#c7 ,additional  
requirem5ts = privacy & data use policy 
,! privacy1 security1 & data use policy 
requir$ "u p>agraph 7#b7 %all include ! 
foll[+3 7,a7 ,id5tity & contact         
in=mation ( ! entity collect+ or        
process+ ! s5sitive p]sonal in=mation4  
7,b7 ,! purpose or use = collect+1 /or+1
 process+1 sell+1 %>+1 or o!rwise us+ ! 
s5sitive p]sonal in=mation4  7,c7       
,categories ( ?ird p>ties ) :om !       
s5sitive p]sonal in=mation w be %>$ & = 
:at g5]al purposes4  7,d7 ,! process by 

:i* individuals may )draw cons5t to !   
collect+1 /or+1 process+1 sell+1 %>+1 or
 o!r use ( ! s5sitive p]sonal in=mation1
 includ+ %>+ ) ?ird p>ties4  7,e7 ,h[ a 
us]1 controll]1 or processor c view or  
obta9 ! s5sitive p]sonal in=mation t !y 
h receiv$ or provid$ to a controll] or  
processor1 includ+ :e!r x c be export$  
to o!r web-bas$ plat=ms4  7,f7 ,!       
categories ( s5sitive p]sonal in=mation 
t is collect$ by ! controll] or         
processor & %>$ ) processors or ?ird    
p>ties4  7,g7 ,h[ s5sitive p]sonal      
in=mation is protect$ f unau?oriz$      
access or acquisition4  7#d7 ,opt-out   
cons5t  7,a7 ,= any collection1         
transmission1 /orage1 process+1 sell+1  
%>+1 or o!r use ( non-s5sitive p]sonal  
in=mation1 includ+ %>+ ) ?ird p>ties1   
controll]s %all provide us]s ) ! ability
 to opt out at any "t4  7,b7 ,controll]s
 %all honor an opt out reque/ f a us] "u
 subp>agraph 7,a7 to ! ext5t ( its role 
9 any collection1 transmission1 /orage1 
process+1 sell+1 %>+1 or o!r use (      

non-s5sitive p]sonal in=mation & %all   
communicate an opt-out reque/ to !      
relevant processor or ?ird p>ty ) :i* ! 
controll] has %>$ in=mation reg>d+ t    
us]4  7,c7 ,processors or ?ird p>ties   
receiv+ an opt out pursuant to          
subp>agraph 7,a7 & 7,b7 %all comply )   
su* opt out to ! ext5t ( _! role 9 any  
collection1 transmission1 /orage1       
process+1 sell+1 %>+1 or o!r use (      
non-s5sitive p]sonal in=mation4  7,d7   
,any controll] t communicates an opt out
 f a us] z requir$ by subp>agraph 7,b7  
%all n be liable = ! failure ( a s]vice 
provid] or ?ird p>ty to comply ) su* opt
 out4  7#e7 ,relation%ip ,betwe5        
,controll] & ,processor  7,a7 ,process+ 
by a processor mu/ be gov]n$ by a       
contract betwe5 ! controll] & !         
processor t is b9d+ on bo? p>ties & t   
sets ! processor to processes ! p]sonal 
data only on docum5t$ in/ructions f !   
controll]4  7,b7 ,processors %all %>e   
s5sitive p]sonal in=mation ) a          
subcontractor only = purposes ( provid+ 

s]vices & only aft] fir/ provid+ !      
controll] ) an opportunity to object4   
7,c7 ,9 no ev5t may any contract or     
docum5t$ in/ructions relieve a controll]
 or a processor f ! obligations &       
liabilities impos$ on !m by ?is ,act4   
7#f7 ,privacy audits  7,a7 ,9 g5]al     
,except z provid$ 9 subp>agraphs 7,c7 & 
7,d71 at lea/ once e #b ye>s1 ea*       
controll]1 processor1 or ?ird p>ty t has
 collect$1 transmitt$1 /or$1 process$1  
sell+1 %>$1 or o!rwise us$ s5sitive     
p]sonal in=mation %all-- 7i7 obta9 a    
privacy audit f a qualifi$1 objective1  
indep5d5t ?ird-p>ty2 &  7ii7 %all make  
publicly available :e!r or n ! privacy  
audit f\nd ! controll]1 processor1 or   
?ird p>ty compliant4  7,b7 ,audit       
requirem5ts ,ea* su* audit %all-- 7i7   
set =? ! privacy1 security1 & data use  
controls t ! controll]1 processor1 or   
?ird p>ty has implem5t$ & ma9ta9$ dur+ !
 report+ p]iod2  7ii7 describe :e!r su* 
controls are appropriate to ! size &    
complexity ( ! controll]1 processor1 or 

?ird p>ty1 ! nature & scope ( !         
activities ( ! controll]1 processor1 or 
?ird p>ty1 & ! nature ( ! s5sitive      
p]sonal in=mation or behavioral data    
collect$ by ! controll]1 processor1 or  
?ird p>ty2  7iii7 c]tify :e!r ! privacy 
& security controls op]ate ) suffici5t  
effectiv5ess to provide reasonable      
assurance to protect ! privacy &        
security ( s5sitive p]sonal in=mation or
 behavioral data1 includ+ ) respect to  
data %>$ ) ?ird p>ties1 & t ! controls h
 s op]at$ ?r\gh\t ! report+ p]iod2  7iv7
 be prep>$ & complet$ )9 #fj days aft] a
 sub/antial *ange to ! controll]'s      
privacy & data use policy describ$ 9    
p>agraph 7#b72 &  7v7 be provid$-- 7,i7 
to ! ,f$]al ,trade ,commission2 &       
7,,ii7 to any attorney g5]al ( a ,/ate1 
or o!r au?oriz$ ,/ate (fic]1 )9 #aj days
 ( receiv+ writt5 reque/ by ! su*       
attorney g5]al1 or o!r au?oriz$ ,/ate   
(fic] :]e su* (fic] has pres5t$ to !    
controll]1 processor1 or ?ird p>ty      
allegations t a violation ( ?is ,act or 

any regulation issu$ "u ?is ,act has be5
 committ$ by ! controll]1 processor1 or 
?ird p>ty4  7,c7 ,small bus9ess audit   
exemption ,! audit requirem5ts describ$ 
9 ?is p>agraph %all n apply to          
controll]s :o collect1 /ore1 process1   
sell1 %>e1 or o!rwise use s5sitive      
p]sonal in=mation relat+ to #bej1jjj or 
few] individuals p] ye>4  7,d7          
,non-s5sitive p]sonal in=mation         
exemption ,! audit requirem5ts set =?   
above %all n apply to controll]s1       
processors or ?ird p>ties :o d n        
collect1 /ore1 process1 sell1 %>e1 or   
o!rwise use s5sitive p]sonal in=mation4 
7,e7 ,rules t d n inc5tivize sell+      
in=mation ,! ,commission %all promulgate
 rules reg>d+ qualifications &          
requirem5ts ( ?ird-p>ty auditors su* z a
 duty to conduct an indep5d5t assessm5t 
t does n inc5tivize ! auditor to sell "u
 ! guise ( a pot5tial violation by !    
controll] products or s]vices :5 !re is 
n a violation ( ! ,act4  7b7 ,exemptions
  7#a7 ,necess>y op]ations & security   

purposes ,subsection 7a7 %all n apply to
 ! process+1 transmission1 collect+1    
/or+1 %>+1 sell+ ( s5sitive &           
non-s5sitive p]sonal in=mation = !      
foll[+ purposes3 7,a7 ,prev5t+ or       
detect+ fraud1 id5tity !ft1 unau?oriz$  
transactions1 !ft1 %oplift+1 or crim9al 
activity includ+ f9ancial crimes & money
 laund]+4  7,b7 ,! use ( su* in=mation  
to id5tify errors t impair functionality
 or o!rwise enhanc+ or ma9ta9+ !        
availability ( ! s]vices or in=mation   
sy/ems ( ! controll] = au?oriz$ access &
 use4  7,c7 ,protect+ ! vital int]e/s ( 
! consum] or ano!r natural p]son4  7,d7 
,respond+ 9 good fai? to valid legal    
process or provid+ in=mation z o!rwise  
requir$ or au?oriz$ by law4  7,e7       
,monitor+ or en=c+ agreem5ts betwe5 !   
,controll]1 processor1 or ?ird p>ty & an
 individual1 includ+ b n limit$ to1 t]ms
 ( s]vice1 t]ms ( use1 us] agreem5ts1 or
 agreem5ts conc]n+ monitor+ crim9al     
activity4  7,f7 ,protect+ ! prop]ty1    
s]vices1 or in=mation sy/ems ( !        

controll]1 processor1 or ?ird p>ty aga9/
 unau?oriz$ access or use4  7,g7        
,advanc+ a sub/antial public int]e/1    
includ+ ar*ival purposes1 sci5tific or  
hi/orical rese>*1 & public heal?1 if su*
 process+ does n create a significant   
risk ( h>m to consum]s4  7,h7 ,uses     
au?oriz$ by ! ,fair ,cr$it ,report+ ,act
 or us$ by a comm]cial cr$it report+    
ag5cy4  7,i7 ,complet+ ! transaction =  
:i* ! p]sonal in=mation 0 collect$1     
provide a good or s]vice reque/$ by !   
consum] t is reasonably anticipat$ )9 ! 
context ( a bus9ess' ongo+ relation%ip )
 ! consum]1 bill or collect = su* good  
or s]vice or o!rwise p]=m a contract    
betwe5 ! controll] & a consum]4  7,j7   
,comply+ ) o!r ,f$]al1 ,/ate1 & local   
law4  7,k7 ,conduct+ product recalls &  
s]vic+ w>ranties4  7#b7 ,reasonable     
expectation ( us]s ,! regulations       
promulgat$ pursuant to subsection 7a7 ) 
respect to ! requirem5t to provide opt-9
 cons5t %all n apply to ! process+1     
transmission1 /orage1 sell+1 %>+1 or    

collection ( s5sitive p]sonal in=mation 
9 :i* su* process+ does n deviate f     
purposes consi/5t ) a controll]'s       
relation%ip ) us]s z und]/ood by !      
reasonable use1 includ+ b n limit$ to-- 
7,a7 c>ry+ out ! t]m ( a contract or    
s]vice agreem5t1 includ+ elem5ts ( a    
cu/om] loyalty program1 ) a us]2  7,b7  
accept+ & process+ a paym5t f a us]2    
7,c7 complet+ a transaction ) a us] su* 
z ?r\gh deliv]+ a good or s]vice ev5 if 
su* deliv]y is made by a processor or   
?ird p>ty2  7,d7 m>k+ goods or s]vices  
to a us] z long z ! us] is provid$ ) !  
ability to opt out ( su* m>ket+2  7,e7  
tak+ /eps to cont9ue or ext5d an exi/+  
bus9ess relation%ip ) a us]1 or invit+ a
 new us] to p>ticipate 9 a cu/om]       
promotion1 b5efit or loyalty program1 z 
long z ! us] is provid$ ) ! ability to  
opt out2  7,f7 conduct int]nal rese>* to
 improve1 repair1 or develop products1  
s]vices1 or te*nology2 or  7,g7         
municipal gov]nm5ts4  #d4 ,application &
 en=cem5t by ! ,f$]al ,trade ,commission

  7a7 ,common c>ri]s ,not)/&+ !         
limitations 9 ! ,f$]al ,trade           
,commission ,act 7#ae ,u4,s4,c4 #da et  
seq47 on ,commission au?ority ) respect 
to common c>ri]s1 ?is ,act applies1     
accord+ to its t]ms1 to common c>ri]s   
subject to ! ,communications ,act ( 7#dg
 ,u4,s4,c4 #aea et seq47 & all ,acts    
am5datory !re( & supplem5t>y !reto4 ,!  
,f$]al ,trade ,commission %all be ! only
 ,f$]al ag5cy ) au?ority to en=ce su*   
common c>ri]s' privacy practices4  7b7  
,en=cem5t  7#a7 ,unfair or deceptive    
acts or practices ,a violation ( ?is    
,act or a regulation promulgat$ "u ?is  
,act %all be treat$ z a violation       
section #ah7;a77#a77;,b7 ( ! ,f$]al     
,trade ,commission ,act 7#ae ,u4,s4,c4  
#eg7;a77#a77;,b77 reg>d+ unfair or      
deceptive acts or practices4  7#b7 ,p[]s
 ( commission ,except z provid$ 9       
subsection 7a71 ! ,f$]al ,trade         
,commission %all en=ce ?is ,act & !     
regulations promulgat$ "u ?is ,act 9 !  
same mann]1 by ! same means1 & ) ! same 

jurisdiction1 p[]s1 & duties z ?\gh all 
applicable t]ms & provisions ( ! ,f$]al 
,trade ,commission ,act 7#ae ,u4,s4,c4  
#da et seq47 7 incorporat$ into & made a
 "p ( ?is ,act4 ,any p]son :o violates  
?is ,act or a regulation promulgat$ "u  
?is ,act %all be subject to ! p5alties &
 entitl$ to ! privileges & immunities   
provid$ 9 ! ,f$]al ,trade ,commission   
,act4  7c7 ,con/ruction ,no?+ 9 ?is ,act
 %all be con/ru$ to limit ! au?ority ( !
 ,f$]al ,trade ,commission "u any o!r   
provision ( law4  7d7 ,opportunity to   
,comply ,! ,commission %all notify a    
controll] ( alleg$ violations & provide 
!m ) #cj days to cure a non-wilful      
violations ( ?is ,act be=e ! ,commission
 %all comm5ce & en=cem5t action4  #e4   
,en=cem5t by ,/ate attorneys g5]al  7a7 
,"r ( action ,except z provid$ 9        
subsection 7e71 ! attorney g5]al ( a    
,/ate1 alleg+ a violation ( ?is ,act or 
any regulation issu$ "u ?is ,act t      
affects or may affect su* ,/ate or its  
resid5ts may br+ an action on behalf ( !

 resid5ts ( ! ,/ate 9 any ,unit$ ,/ates 
di/rict c\rt = ! di/rict 9 :i* !        
def5dant is f\nd1 resides1 or transacts 
bus9ess1 or :]ev] v5ue is prop] "u      
section #acia ( title #bh1 ,unit$ ,/ates
 ,code1 to obta9 appropriate injunctive 
relief4  7b7 ,notice to commission      
requir$ ,a ,/ate %all provide prior     
writt5 notice to ! ,f$]al ,trade        
,commission ( any civil action "u       
subsection 7a7 toge!r ) a copy ( its    
compla9t1 except t if x is n feasible = 
! ,/ate to provide su* prior notice1 !  
,/ate %all provide su* notice imm$iately
 ^u in/itut+ su* action4  7c7           
,int]v5tion by ! commission ,!          
,commission may int]v5e 9 su* civil     
action & ^u int]v5+-- 7#a7 be he>d on   
all matt]s aris+ 9 su* civil action2 &  
7#b7 file petitions = appeal ( a        
decision 9 su* civil action4  7d7       
,con/ruction ,no?+ 9 ?is section %all be
 con/ru$-- 7#a7 to prev5t ! attorney    
g5]al ( a ,/ate1 or o!r au?oriz$ ,/ate  
(fic]1 f ex]cis+ ! p[]s conf]r$ on !    

attorney g5]al1 or o!r au?oriz$ ,/ate   
(fic]1 by ! laws ( su* ,/ate2 or  7#b7  
to prohibit ! attorney g5]al ( a ,/ate1 
or o!r au?oriz$ ,/ate (fic]1 f proce$+ 9
 ,/ate or ,f$]al c\rt on ! basis ( an   
alleg$ violation ( any civil or crim9al 
/atute ( t ,/ate4  7e7 ,limitation  7#a7
 ,no sep>ate action ,an action may n be 
br\ght "u subsection 7a7 if ! same      
alleg$ violation is ! subject ( a p5d+  
action by ! ,commission or ! ,unit$     
,/ates4  7#b7 ,exclusive p]iod to act by
 commission ,an action-- 7,a7 may n be  
br\ght "u subsection 7a7 until !        
expiration ( ! #fj-;day p]iod t beg9s on
 ! date on :i* a violation is discov]$  
by ! ,commission or ! date on :i* !     
,commission is notifi$ ( ! violation2 & 
7,b7 may only be br\ght "u subsection   
7a7 if ! ,commission does n br+ an      
action relat$ to ! violation dur+ su*   
p]iod4  7f7 ,opportunity to ,comply     
,prior to br++ any action "u ?is        
section1 ! /ate attorney g5]al %all     
notify a controll] ( alleg$ violations &

 provide !m ) #cj days to cure a        
non-wilful violations ( ?is ,act be=e   
comm5c+ an en=cem5t action4  #f4        
,privacy & data security employees &    
fund+ = ! ,commission  7a7 ,employm5t   
au?ority ,! ,commission %all hire #ejj  
new full-"t employees to focus on       
privacy & data security1 #ej ( :i* %all 
h te*nology exp]tise4  7b7 ,additional  
fund+ = privacy & data security ,!re is 
au?oriz$ to be appropriat$ to !         
,commission #cej1jjj1jjj = issues relat$
 to privacy & data security4  #g4       
,def9itions ,9 ?is ,act ! foll[+        
def9itions apply3 7#a7 ,call detail     
record ,! t]m call detail record-- 7,a7 
means session-id5tify+ in=mation        
7includ+ an orig9at+ or t]m9at+         
telephone numb]1 an ,int]national       
,mobile ,subscrib] ,id5tity numb]1 or an
 ,int]national ,mobile ,/ation ,equipm5t
 ,id5tity numb]71 a telephone call+ c>d 
numb]1 or ! "t or duration ( a call2    
7,b7 does n include-- 7i7 ! cont5ts 7z  
def9$ 9 section 7#h7 ( title #ah1 ,unit$

 ,/ates ,code7 ( any communication2     
7ii7 ! "n1 address1 or f9ancial         
in=mation ( a subscrib] or cu/om]2      
7iii7 cell site location or global      
position+ sy/em in=mation2 or  7iv7     
bus9ess cu/om]s4  7#b7 ,cle> & prom95t  
,! t]m cle> & prom95t means 9 any       
communication m$ium1 ! requir$          
disclosure is-- 7,a7 ( a type1 size1 &  
location suffici5tly noticeable = an    
ord9>y consum] to read & compreh5d !    
communication2  7,b7 provid$ 9 a mann]  
su* t an ord9>y consum] is able to read 
& compreh5d ! communication2  7,c7 is   
pres5t$ 9 an und]/&able language &      
syntax2  7,d7 includes no?+ contr>y to1 
inconsi/5t )1 or t mitigates any /atem5t
 conta9$ )9 ! disclosure or )9 any      
docum5t l9k$ to or ref]5c$ !re92 &  7,e7
 includes an option t is compliant )    
applicable obligations ( ! controll] "u 
title ,,iii ( ! ,am]icans )             
,disabilities ,act ( #aiij 7#db         
,u4,s4,c4 #abaha et seq474  7#c7        
,collection ,! t]m collection means     

buy+1 r5t+1 ga!r+1 obta9+1 receiv+1 or  
access+ any s5sitive data ( an          
individual by any means4  7#d7          
,commission ,! t]m ,commission means !  
,f$]al ,trade ,commission4  7#e7        
,controll] ,! t]m controll] means a     
p]son t1 on its own or jo9tly ) o!r     
entities1 det]m9es ! purposes & means ( 
process+ s5sitive p]sonal in=mation4    
7#f7 ,de-,id5tifi$ ,data ,! t]m         
de-id5tifi$ data means in=mation held   
t-- 7,a7 does n id5tify1 & is n l9k$ or 
reasonably l9kable to1 & individual or  
device2  7,b7 does n conta9 a p]si/5t   
id5tifi] or o!r in=mation t c\ld readily
 be us$ to de-id5tify ! individual to   
:om1 or ! device to :i*1 ! id5tifi] or  
in=mation p]ta9s2  7,c7 is subject to a 
public commitm5t by ! entity2  7,d7 to  
refra9 f attempt+ to use su* in=mation  
to id5tify any individual or device2    
7,e7 to adopt te*nical & organizational 
measures to ensure t su* in=mation is n 
l9k$ to any individual or device2 &     
7,f7 is n disclos$ by ! cov]$ entity to 

any o!r p>ty unless ! disclosure is     
subject to a contractually or o!r       
legally b9d+ requirem5t4  7#g7 ,employee
 data ,! t]m employee data means-- 7,a7 
in=mation relat+ to an individual       
collect$ 9 ! c\rse ( ! individual act+ z
 a job applicant to1 or employee        
7reg>dless ( :e!r su* employee is paid (
 unpaid1 or employ$ on a tempor>y       
basis71 own]1 director1 (fic]1 /aff     
memb]1 tra9ee1 v5dor1 visitor1 volunte]1
 int]n1 or contractor2  7,b7 bus9ess    
contact in=mation ( an individual1      
includ+ ! individual's "n1 position or  
title1 bus9ess telephone numb]1 bus9ess 
address1 bus9ess email address1         
qualifications1 & o!r simil> in=mation t
 is provid$ by an individual :o is act+ 
9 a pr(essional capacity1 provid$ t su* 
in=mation is collect$1 process$1 or     
transf]r$ solely = purposes relat$ to   
su* individuals' pr(essional activities2
 or  7,c7 em]g5cy contact in=mation     
collect$ by a cov]$ entity t relates to 
an individual :o is act+ 9 a role       

describ$ 9 subp>agraph 7,a74  7#h7      
,processor ,! t]m processor means a     
p]son t processes data on behalf ( a    
controll] or ano!r processor accord+ to 
& = ! purposes set =? 9 ! docum5t$      
in/ructions4 ,if a p]son processes data 
on its own behalf or = its own purposes1
 !n t p]son is n a processor ) respect  
to t data b is in/ead a controll]4      
,det]m9+ :e!r a p]son is act+ z a       
controll] or processor ) respect to a   
specific process+ ( data is a fact-bas$ 
det]m9ation t dep5ds ^u ! controll]'s   
docum5t$ in/ructions & ! context 9 :i*  
p]sonal data is to be process$4 ,a      
processor %all only rema9 a processor to
 ! ext5t t x cont9ues to process data = 
! sole purposes set =? 9 ! docum5t$     
in/ructions ( ! controll] & adh]es to ^?
 in/ructions & ! limitations 9 !        
controll]'s privacy policy z communicat$
 to ! processor ) respect to a specific 
process+ ( p]sonal in=mation4  7#i7     
,s5sitive p]sonal in=mation  7,a7 ,! t]m
 s5sitive p]sonal in=mation means       

in=mation relat+ to an id5tifi$ or      
id5tifiable individual t is-- 7i7       
f9ancial acc\nt numb]s2  7ii7 heal?     
in=mation2  7iii7 g5etic data2  7iv7 any
 in=mation p]ta9+ to *ildr5 "u #ac ye>s 
( age2  7v7 ,social ,security numb]s2   
7vi7 unique gov]nm5t-issu$ id5tifi]s2   
7vii7 au!ntication cr$5tials = a        
f9ancial acc\nt1 su* z a us]name &      
password2  7viii7 precise geolocation   
in=mation2  7ix7 cont5t ( a p]sonal wire
 communication1 oral communication1 or  
electronic communication su* z e-mail or
 direct messag+ ) respect to any entity 
t is n ! int5d$ recipi5t ( !            
communication2  7x7 call detail records 
= calls conduct$ 9 a p]sonal & n a      
bus9ess capacity2  7xi7 biometric       
in=mation2  7xii7 sexual ori5tation1    
g5d] id5tity1 or int]sex /atus2  7xiii7 
citiz5%ip or immigration /atus2  7xiv7  
m5tal or physical heal? diagnosis2  7xv7
 religi\s beliefs2 or  7xvi7 web br[s+  
hi/ory1 application usage hi/ory1 & !   
functional equival5t ( ei!r t is data   

describ$ 9 ?is subp>agraph t is n       
aggregat$ data4  7,b7 ,! t]m s5sitive   
p]sonal in=mation does n include-- 7i7  
de-id5tifi$ in=mation 7or ! measurem5t1 
analysis or process utiliz$ to trans=m+ 
p]sonal data s t x is n directly        
relatable to an id5tifi$ or id5tifiable 
consum]72  7ii7 in=mation relat$ to     
employm5t1 includ+ any employee data2   
7iii7 p]sonal in=mation reflect+ a      
writt5 or v]bal communication or a      
transaction betwe5 a controll] & ! us]1 
:]e ! us] is a natural p]son :o is act+ 
z an employee1 own]1 director1 (fic]1 or
 contractor ( a company1 p>tn]%ip1 sole 
proprietor%ip1 non-pr(it1 or gov]nm5t   
ag5cy & ^: communications or transaction
 ) ! controll] occur solely )9 ! context
 ( ! controll] conduct+ due dilig5ce    
reg>d+1 or provid+ or receiv+ a product 
or s]vice to or f su* company1 p>tn]%ip1
 sole proprietor%ip1 non-pr(it1 or      
gov]nm5t ag5cy2 or  7iv7 publicly       
available in=mation4  7#aj7 ,/ate ,! t]m
 ,/ate means ea* ,/ate ( ! ,unit$       

,/ates1 ! ,di/rict ( ,columbia1 & ea*   
commonweal?1 t]ritory1 or possession ( !
 ,unit$ ,/ates4  7#aa7 ,?ird p>ty ,! t]m
 ?ird p>ty means an individual or entity
 t uses or receives s5sitive p]sonal    
in=mation obta9$ by or on behalf ( a    
controll]1 o!r ?an-- 7,a7 a s]vice      
provid] ( a controll] to :om ! controll]
 discloses ! consum]'s s5sitive p]sonal 
in=mation = an op]ational purpose       
subject to section #c7;a77#a77;,b7 ( ?is
 ,act2 &  7,b7 any entity t uses        
s5sitive p]sonal in=mation only z       
reasonably necess>y-- 7i7 to comply )   
applicable law1 regulation1 or legal    
process2  7ii7 to en=ce ! t]ms ( use ( a
 controll]2  7iii7 to detect1 prev5t1 or
 mitigate fraud or security             
vuln]abilities2 or  7iv7 does n det]m9e 
! purposes & means ( process+ s5sitive  
p]sonal in=mation4  7#ab7 ,transf] ,!   
t]m transf] means to disclose1 release1 
%>e1 dissem9ate1 make available1 or     
lic5se 9 writ+1 electronically or by any
 o!r means1 = consid]ation ( any k9d = a

 comm]cial purpose4  #h4 ,rules (       
con/ruction  7a7 ,f$]al acquisition     
,no?+ 9 ?is ,act may be con/ru$ to      
preclude ! acquisition by ! ,f$]al      
,gov]nm5t (-- 7#a7 ! cont5ts ( a wire or
 electronic communication pursuant to   
o!r lawful au?orities1 includ+ !        
au?orities "u *apt] #aai ( title #ah1   
,unit$ ,/ates ,code 7commonly kn[n z !  
,wiretap ,act71 ! ,=eign ,intellig5ce   
,surveillance ,act ( #aigh 7#ej         
,u4,s4,c4 #ahja et seq471 or any o!r    
provision ( ,f$]al law n specifically   
am5d$ by ?is ,act2 or  7#b7 records or  
o!r in=mation relat+ to a subscrib] or  
cu/om] ( any electronic communication   
s]vice or remote comput+ s]vice 7n      
includ+ ! cont5t ( su* communications7  
pursuant to ! ,=eign ,intellig5ce       
,surveillance ,act ( #aigh 7#ej         
,u4,s4,c4 #ahja et seq471 *apt] #aai (  
title #ah1 ,unit$ ,/ates ,code 7commonly
 kn[n z ! ,wiretap ,act71 or any o!r    
provision ( ,f$]al law n specifically   
am5d$ by ?is ,act4  7b7 ,effect on o!r  

laws ,no?+ 9 ?is ,act %all be con/ru$ to
 limit or sub/itute = ! requirem5ts "u  
title ,v ( ! ,gramm-,lea*-,bliley ,act  
7#ae ,u4,s4,c4 #fhja et seq471 section  
#bfd7;c7 ( ! ,heal? ,insurance          
,portability & ,acc\ntability ,act (    
#aiif 7,public ,law #ajd-aia71 section  
#ddd ( ! ,g5]al ,education ,provisions  
,act 7commonly kn[n z ! ,family         
,educational ,rights & ,privacy ,act (  
#aigd7 7#bj ,u4,s4,c4 #abcb;g71 ! ,fair 
,cr$it ,report+ ,act 7#ae ,u4,s4,c4     
#afha et seq474  #i4 ,national /&>d  7a7
 ,relation%ip to /ate law ,no ,/ate or  
political subdivision ( a ,/ate may     
adopt1 ma9ta91 en=ce1 or cont9ue 9      
effect any law1 regulation1 rule1       
requirem5t1 or /&>d relat$ to ! data    
privacy or associat$ activities ( cov]$ 
entities4  7b7 ,nonpreemption           
,subsection 7a7 %all n be con/ru$ to--  
7#a7 preempt ,/ate laws t directly      
e/abli% requirem5ts = ! notification (  
consum]s 9 ! ev5t ( a data brea*2  7#b7 
preempt ,/ate laws t directly e/abli%   

requirem5ts reg>d+ biometric laws2  7#c7
 preempt ,/ate laws reg>d+ wiretapp+    
laws2 or  7#d7 preempt ,/ate laws l !   
,public ,records ,act4  #aj4 ,effective 
,date ,?is ,act %all take effect #ahj   
days aft] ! date ( ! enactm5t ( ?is     
,act4